aboutsummaryrefslogtreecommitdiffstats
path: root/reassemble.c
Commit message (Collapse)AuthorAgeFilesLines
* When showing a fragment subtree, put spaces after colons to make thingsTim Potter2003-09-251-3/+3
| | | | | | look a bit nicer. Also separate frame and payload data by a comma. svn path=/trunk/; revision=8538
* Update a comment.Guy Harris2003-08-281-2/+5
| | | | svn path=/trunk/; revision=8296
* Make "process_reassembled_data()" do the check for fragmentation notGuy Harris2003-08-281-32/+48
| | | | | | | | | | | being complete and for fragmentation being trivial (i.e., the packet in question is both the first and last fragment). Have its callers *not* do that check - this lets "process_reassembled_data()" put in the "Reassembled in" item for fragments other than the last fragment. Add a "Reassembled in" field to TDS. svn path=/trunk/; revision=8295
* From Tomas Kukosa: set FD_DEGRAGMENTED even if there's only oneGuy Harris2003-07-311-1/+2
| | | | | | fragment. svn path=/trunk/; revision=8117
* There can be more than one DCE RPC call per frame, e.g. there can beGuy Harris2003-06-041-37/+56
| | | | | | | | multiple NetBIOS-over-TCP session service messages in a TCP segment, and they can contain the final portions of different DCERPC calls. Don't assume a frame number is sufficient to identify DCE RPC calls. svn path=/trunk/; revision=7777
* Fix up the overlap checks in the fragment_add_seq functions forGuy Harris2003-04-301-17/+65
| | | | | | fully-reassembled packets. svn path=/trunk/; revision=7615
* Add a pointer to an hf_ value for a "reassembled_in" field (which can beGuy Harris2003-04-201-29/+60
| | | | | | | | | | | | | | null) to the "fragment_items" structure, and don't pass that value into "process_reassembled_data()", just have it use the value in the "fragment_items" structure passed to it. Make "process_reassembled_data()" capable of handling reassembly done by "fragment_add_seq_check()", and use it in the ATP and 802.11 dissectors; give them "reassembled_in" fields. Make "process_reassembled_data()" handle only the case of a completed reassembly (fd_head != NULL) so that we can use it in those dissectors without gunking the code up too much. svn path=/trunk/; revision=7513
* Put entries for a reassembled packet into the appropriate hash table forGuy Harris2003-04-201-41/+20
| | | | | | | | all of the frames that make it up, so Ethereal can show, for all but the final frame, the frame in which it was reassembled. (Tethereal can't, as it's a one-pass program.) svn path=/trunk/; revision=7511
* Pull much of the processing done after a call to "fragment_add_check()"Guy Harris2003-04-201-1/+86
| | | | | | | | into a subroutine, for use in other dissectors. Use it in the IPv6 and CLNP dissectors. svn path=/trunk/; revision=7510
* Add a "fragment_add_multiple_ok()" routine that skips the check for aGuy Harris2003-04-201-6/+31
| | | | | | | | | | fragment having been added already. In protocols using the ONC RPC-over-TCP record-marking mechanism (RPC-over-TCP and NDMP), there can be more than one record-marking-layer fragment in a single TCP segment, and thus can be more than one fragment in a frame being added to a given higher-level packet. svn path=/trunk/; revision=7508
* We can't use the frame_data structure as a key structure when lookingGuy Harris2003-04-201-131/+248
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | for reassembled frames - in Tethereal, there's only one frame_data structure used for all frames. Instead, use the frame number itself as the key. Add a "fragment_add_check()" routine, for fragments where there's a fragment offset rather than a fragment sequence number, which does the same sort of thing as "fragment_add_seq_check()" - i.e., once reassembly is done, it puts the reassembled fragment into a separate hash table, so that there're only incomplete reassemblies in the fragment hash table. That's necessary in order to handle cases where the packet ID field can be reused. Use that routine for IPv4 fragment reassembly - IP IDs can be reused (in fact, RFC 791 suggests that doing so might be a feature: It is appropriate for some higher level protocols to choose the identifier. For example, TCP protocol modules may retransmit an identical TCP segment, and the probability for correct reception would be enhanced if the retransmission carried the same identifier as the original transmission since fragments of either datagram could be used to construct a correct TCP segment. and RFC 1122 says that it's permitted to do so, although it also says "we believe that retransmitting the same Identification field is not useful": 3.2.1.5 Identification: RFC-791 Section 3.2 When sending an identical copy of an earlier datagram, a host MAY optionally retain the same Identification field in the copy. DISCUSSION: Some Internet protocol experts have maintained that when a host sends an identical copy of an earlier datagram, the new copy should contain the same Identification value as the original. There are two suggested advantages: (1) if the datagrams are fragmented and some of the fragments are lost, the receiver may be able to reconstruct a complete datagram from fragments of the original and the copies; (2) a congested gateway might use the IP Identification field (and Fragment Offset) to discard duplicate datagrams from the queue. However, the observed patterns of datagram loss in the Internet do not favor the probability of retransmitted fragments filling reassembly gaps, while other mechanisms (e.g., TCP repacketizing upon retransmission) tend to prevent retransmission of an identical datagram [IP:9]. Therefore, we believe that retransmitting the same Identification field is not useful. Also, a connectionless transport protocol like UDP would require the cooperation of the application programs to retain the same Identification value in identical datagrams. and, in any case, I've seen that in at least one capture, and it confuses the current reassembly code). Unfortunately, that means that fragments other than the last fragment can't be tagged with the frame number in which the reassembly was done; see the comment in packet-ip.c for a discussion of that problem. svn path=/trunk/; revision=7506
* The first element in a fragment list isn't a fragment, it's a specialGuy Harris2003-04-191-14/+26
| | | | | | | | entry for the reassembled packet; don't look at it when checking to see if we've already seen a fragment (its "frame" field isn't initialized, so we shouldn't check it in any case). svn path=/trunk/; revision=7498
* Add a small extra check in fragment_add() to make it idempotent.Ronnie Sahlberg2003-04-171-2/+16
| | | | | | | | | This solves a problem introduced by the recent rewrite of dcerpc-over-smb reassembly which caused the last fragment for each dcerpc pdu to be duplicated and flagged as overlapping fragment. This svn path=/trunk/; revision=7478
* Added new field reassembled_in to the fragment data structure.Ronnie Sahlberg2003-04-091-2/+7
| | | | | | | | | | | This field gets set to the frame number when this pdu was first completely reassembled. This is useful since it will allow us to do reassembly properly in say packet-ip.c instead of printing the full pdu for every fragment and thus making NFSoverUDP rpc-rtt statistics less than useful. A dissector using fragment_add() can tehn choose to only dissect the reassembled PDU only for the frame where it was first reassembled. svn path=/trunk/; revision=7427
* When deciding whether we have enough data in a lower-level packet toGuy Harris2003-03-041-4/+4
| | | | | | | | | | | | | | | | attempt reassembly of a higher-level packet that includes the lower-level packet, use "tvb_bytes_exist()" to check whether all the data that's to be included in the reassembly is available, rather than by checking whether the packet is short. Add some checks of that sort that were missing. Use the reported length of the packet when doing reassembly. Make the "iphdrlen" field of a "packet_info" structure be the length of the IP header in bytes, not in 4-byte words. svn path=/trunk/; revision=7274
* Update reassemble.c/show_item and all callers to use FT_FRAMENUM for the ↵Ronnie Sahlberg2002-12-191-3/+5
| | | | | | list of packets corresponding to a reassembled pdu svn path=/trunk/; revision=6807
* Don't cast away constness, and fix variable and structure memberGuy Harris2002-12-021-7/+7
| | | | | | | | | | | | | qualifiers as necessary to ensure that we don't have to. "strcmp()", "strcasecmp()", and "memcmp()" don't return booleans; don't test their results as if they did. Use "guint8", not "guchar", for a pointer to (one or more) 8-bit bytes. Update Michael Tuexen's e-mail address. svn path=/trunk/; revision=6726
* Add a "fragment_add_seq_next()" to reassemble fragments that don't haveGuy Harris2002-10-241-15/+64
| | | | | | | | | | | | | | | | | | | | | | | | sequence numbers or offsets and are thus assumed to be received in order with no duplicates or dropped fragments (e.g., for NetBIOS Frame, where 802.2 LLC guarantees in-order delivery to NetBIOS with no duplicates or dropped fragments). "show_fragment_tree()' and "show_fragment_seq_tree()" don't modify the "fragment_items" to which the "fit" argument points, so make that argument a "const fragment_items *". Make all the "fragment_items" tables "static" (as they're not used outside the modules defining them) and "const" (as they're not modified). Add support for reassembly of NetBIOS fragmented requests and responses. Get rid of an unnecessary include of "packet-tr.c" in the NetBIOS dissector, and make its table of dissection function pointers static. Fix some typos in the AppleTalk and NetBIOS dissectors. svn path=/trunk/; revision=6491
* Flag fragment overlaps when reassembling based on sequence number, and,Guy Harris2002-10-171-12/+20
| | | | | | | when displaying the fragment tree for reassembly based on sequence number, show the correct offset. svn path=/trunk/; revision=6448
* Put in a missing check for fragment overlaps, and add an assertion toGuy Harris2002-10-171-2/+7
| | | | | | check for bogus dfpos values before using the value. svn path=/trunk/; revision=6447
* Removed trailing whitespaces from .h and .c files using theJörg Mayer2002-08-281-40/+40
| | | | | | | winapi_cleanup tool written by Patrik Stridvall for the wine project. svn path=/trunk/; revision=6117
* Don't check for a short frame until we care whether the frame is short;Guy Harris2002-06-171-5/+2
| | | | | | that lets us get rid of a variable. svn path=/trunk/; revision=5689
* Put the stuff to add the "Illegal {fragment,segment}" item to the InfoGuy Harris2002-06-071-21/+19
| | | | | | | column, and to return TRUE or FALSE, depending on whether there were any reassembly errors, in a common routine. svn path=/trunk/; revision=5645
* Add "show_fragment_seq_tree()", which is like "show_fragment_tree()",Guy Harris2002-06-071-63/+116
| | | | | | | | | | | | | | | but for stuff reassembled with "fragment_add_seq()" or "fragment_add_seq_check()". Add a "fragment tag" string to the "fragment_items", so that packets with fragmentation errors can be properly flagged as having "Illegal fragments" or "Illegal segments" depending on the term used with the protocol in question. Make all the dissectors that can use "show_fragment_tree()" or "show_fragment_seq_tree()", and don't already use them, do so. svn path=/trunk/; revision=5644
* Added show_fragment_tree() to reassemble. This function will do the commonRonnie Sahlberg2002-06-051-1/+90
| | | | | | | | | | task of creating a fregment tree for the fragmented packets. Having this identical code to create this tree in every dissector that does PDU reassembly is a huge waste and duplication of code. Updated IP, SMB and DCERPC to use the new function. svn path=/trunk/; revision=5626
* Reassembly of fragmented DCE/RPC (only for connection oriented DCE/RPC).Ronnie Sahlberg2002-05-241-1/+21
| | | | svn path=/trunk/; revision=5548
* "fragment_add_seq_work()" returns a Boolean value, not a pointer, soGuy Harris2002-04-251-2/+2
| | | | | | have it return FALSE, not NULL. svn path=/trunk/; revision=5249
* Get rid of some unused variables and arguments.Guy Harris2002-04-221-12/+4
| | | | svn path=/trunk/; revision=5221
* In "fragment_add_seq_check()", handle short frames the same wayGuy Harris2002-04-171-49/+24
| | | | | | | | | | | | regardless of whether they're the first frame we see in a reassembly or not - put all but the last fragment into the hash table (so subsequent frames with the same reassembly ID don't get misdissected as unfragmented frames), return the head of the fragment list for the first fragment and NULL for all other fragments (so the first fragment gets dissected as a fragmented packet), and unhash the fragment head from the reassembly hash table when we see the last fragment. svn path=/trunk/; revision=5189
* Don't try to reassemble short frames - but do still pass them through atGuy Harris2002-04-171-17/+86
| | | | | | | | least some of the reassembly mechanism, so we can deal with both bogus and real last fragment (display the bogus ones as unfragmented frames, treat the real ones as fragments). svn path=/trunk/; revision=5186
* Don't bother with "reassembled_key" structures - just use theGuy Harris2002-04-171-52/+33
| | | | | | | | | | | | | | | "frame_data" structure for the frame as the key structure, and use the frame number in that field as the key. (We could be even cheesier and use the frame number as the key, with casts.) When we move an entry from the hash table of reassemblies to the hash table of reassembled packets, free the key structure for the first hash table. (This doesn't plug a leak, as they get freed when you reinitialize the data structures, but it does reduce the memory needed for them to the amount needed for in-progress reassemblies rather than the amount needed for all reassemblies.) svn path=/trunk/; revision=5180
* Add a separate hash table to the reassembly code for reassembledGuy Harris2002-04-171-67/+343
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | packets, using the reassembly ID and the frame number of the final frame as the key. There is no guarantee that reassembly IDs won't be reused, even when talking between the same source and destination address; if, once reassembly is complete, the "fragment_data" structure is moved to the latter hash table, this will keep reused reassembly IDs from causing mis-reassembly. Add a routine "fragment_add_seq_check()", which if a fragment has the "more fragments" flag not set but is the first fragment of a reassembly, treats that as a non-fragmented frame, allocating a "fragment_data" structure for the reassembly but not attaching any fragment to it, and adding it to a reassembled packet list; if a packet has been reassembled, removes it from the table of reassemblies and moves it to the table of reassembled packets; if the frame's been seen already, looks it up in the table of reassembled packets rather than the table of reassemblies. Add reassembly support for fragmented 802.11 frames. Use "fragment_add_seq_check()" to cope with the fact that some hardware+drivers apparently hands us reassembled frames with a non-zero fragment number and the "more fragments" bit clear (as if it puts the 802.11 header of the *last* fragment onto the reassembled data). svn path=/trunk/; revision=5177
* Rename the "frag_offset" argument of "fragment_add_seq()" toGuy Harris2002-04-171-5/+5
| | | | | | | "frag_number", to make it clearer that it's not a byte offset but a sequence number. svn path=/trunk/; revision=5175
* From Joerg Mayer: mark function arguments as unused.Guy Harris2002-03-311-2/+2
| | | | svn path=/trunk/; revision=5052
* From Ricardo Barroetave�a: support dissectors that are handedGuy Harris2002-02-031-10/+76
| | | | | | | | | | reassembled TCP data being able to indicate that they need still more reassembly, so that, for example, a dissector can indicate that it needs reassembly in order to dissect a header that says how long the PDU is and, when that reassembly is done and it dissects the header, it can then indicate that it needs more reassembly to get the entire PDU. svn path=/trunk/; revision=4694
* Include files from the "epan" directory and subdirectories thereof withGuy Harris2002-01-211-2/+2
| | | | | | | | | | | | | "epan/..." pathnames, so as to avoid collisions with header files in any of the directories in which we look (e.g., "proto.h", as some other package has its own "proto.h" file which it installs in the top-level include directory). Don't add "-I" flags to search "epan", as that's no longer necessary (and we want includes of "epan" headers to fail if the "epan/" is left out, so that we don't re-introduce includes lacking "epan/"). svn path=/trunk/; revision=4586
* WTP reassembly, from Tom Uijldert.Guy Harris2002-01-041-4/+4
| | | | svn path=/trunk/; revision=4480
* From Ronnie Sahlberg: new infrastructure to reassemble packets whereGuy Harris2001-12-151-2/+241
| | | | | | fragments are identified by block sequence numbers and not byte offsets. svn path=/trunk/; revision=4398
* Assorted changes from Ronnie Sahlberg:Guy Harris2001-11-241-1/+99
| | | | | | | | | | | | | | | | | | | | Add a few small functions to reassemble.c to cope with protocols where the total length of defragmented PDUs are specified in the first fragment (all previous uses of reassembly has been for PDUs where the last fragment is signalled by a flag in the header for the last fragment). Add a few small functions to reassemble.c to abort-and-delete defragmentation of PDUs and also detect IF a PDU is currently being defragmented. (Useful for PDUs where the "unique" identifier is rather ununique, or may be reused often enough so it can be a problem for Ethereal.) Change where NT Cancel presents its Cancelation-to output, and makes the three trans secondary requests also output similar information. svn path=/trunk/; revision=4255
* Get rid of some unused variables.Guy Harris2001-11-211-1/+3
| | | | svn path=/trunk/; revision=4240
* TCP desegmentation support, and changes to the ONC RPC and NBSSGuy Harris2001-09-131-4/+15
| | | | | | | | | | dissectors to use it, from Ronnie Sahlberg, with additional changes to handle the case where a frame contains messages that don't run past the end followed by one that does and where a reassembled chunk has, at the end, a message that runs past the end of that chunk (because the reassembly was for an earlier message). svn path=/trunk/; revision=3923
* Include <string.h> to get "memcmp()" and "memcpy()" declared.Guy Harris2001-06-281-1/+3
| | | | svn path=/trunk/; revision=3619
* Move the fragment reassembly code into "reassemble.c" andGuy Harris2001-06-081-0/+371
"reassemble.h", and remove IPv4 dependencies from it. Use it for OSI CLNP segment reassembly as well. svn path=/trunk/; revision=3525
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-26 14:05:59 +0000